|
|
|
Windows file systems
The main Windows file systems are FAT (with FAT32 extension) and NTFS. The more recent ExFAT file system, the completely new implementation of FAT file system idea is not widely used yet. Like any deleted data recovery, the file recovery from these file systems is possible until actual disk space is re-used for a new file.
File system: FAT/FAT32
File deletion action: Directory record marked as 'unused'. Clusters are marked as 'free' that destroys chain of clusters, used by file.
Non-fragmented file recovery: File name, size and on-disk position remain inside of directory record so file recovery chances are near 100%.
Fragmented file recovery: The chain of file clusters is destroyed so there is no information about file fragments. The are known file name, file size and start position. Using heuristics it's possible to guess fragments locations but there are no guarantees for correct guess.
Recommended to recover files with:
Raise Data Recovery for FAT
UFS Explorer Standard Recovery
File system: NTFS
MacOS file systems
This section includes deleted files recovery for HFS+ file system (the old HFS file system is not used anymore):
File system: HFS+
Linux file systems
This section includes analysed XFS, Ext2/Ext3 and Reiser file systems.
File system: XFS
File deletion action: XFS clears a part of information about file node and updates tree of free blocks. Information about file name is unlinked from directory entry.
Non-fragmented file recovery: Using heuristics, it's possible to find file name and file size and position rounded to block. Chances for recovery are near 100%; whereas chances to retrieve real file name are near 80%.
Fragmented file recovery: File name, size and fragments' chain can be retrieved using heuristics. If file data is not damaged, file recovery chances are near 100%. Chances to get real file name are near 80%.
Recommended to recover files with:
Raise Data Recovery for XFS
UFS Explorer Standard Recovery
File system: Ext2
File deletion action: Ext2 marks file node as free and updates map of free blocks. Information about file name is unlinked from directory entry. File name to node reference is wiped.
Non-fragmented file recovery: Information about file start and size could remain on disk. Analysis of nodes can help recover good files. At the same time, information about file name is lost.
Fragmented file recovery: The same as for non-fragmented files.
Recommended to recover files with:
Raise Data Recovery for Ext2/Ext3/Ext4
UFS Explorer Standard Recovery
File system: Ext3/Ext4
File deletion action: The file system wipes file node and updates map of free blocks. Information about file name is unlinked from directory entry, yet it references the right node.
Non-fragmented file recovery: Information about file start and size is destroyed permanently. Nevertheless, it may remain in file system journal. The link between file name and on-disk location lacks. Heuristics and journal analysis make possible to recover good files even with real names.
Fragmented file recovery: Usually, information about first 12 blocks of a file lacks. There is also no information about file name and size. Chances for recovery of a deleted file are quite poor, however, information about most recently deleted files may still remain in file system journal that increases chances to recover a file with real file name up to 100%.
Recommended to recover files with:
Raise Data Recovery for Ext2/Ext3/Ext4
UFS Explorer Standard Recovery
File system: ReiserFS
File deletion action: The system updates its S+-tree to exclude a file and renews the map of free space.
Non-fragmented file recovery: S+-tree node may remain on disk (copy in file system journal and old copy, created with copy-on-write). In this case file recovery chances could be up to 100%.
Fragmented file recovery: The same as for non-fragmented files.
Recommended to recover files with:
Raise Data Recovery for ReiserFS
UFS Explorer Standard Recovery
File system: JFS (JFS2)
File deletion action: JFS updates the counter of object use and releases inode in inode use map. The directory is rebuilt to reflect changes.
Non-fragmented file recovery: File inode still resides on disk, so the quality of file recovery is about 100%. Chances are low for file name recovery.
Fragmented file recovery: The same as for non-fragmented files.
Recommended to recover files with:
Raise Data Recovery for JFS
UFS Explorer Standard Recovery
BSD, Solaris, Unix file systems
This section includes only analyzed UFS and UFS2 file systems.
File system: UFS/UFS2
File deletion action: UFS clears file node and updates map of free blocks. Information about file name is unlinked from directory entry.
Non-fragmented file recovery: Information about file start and size is destroyed permanently. The link between file name and on-disk location lacks. Heuristics methods make possible to recover good files of known file type. At the same time, non-fragmented files on UFS can be seen rarely due to the specifics of the algorithm of its Soft Updates.
Fragmented file recovery: The information about first 12 blocks of a file lacks. There is also no information about file name and size. Chances for deleted file recovery are quite poor, yet possible.
Recommended to recover files with:
Raise Data Recovery for UFS
UFS Explorer Standard Recovery
Clustered file systems
Data recovery from file systems like Apple Xsan (CentraVision file system, StorNext file system), RedHat Linux Global File System (GFS), VMware ESX Server Virtual Machine File System (VMFS) and so on has been analyzed by LLC SysDev Laboratories but will not be available in our retail software products. If you are interested in data recovery from these file systems - feel free to use our remote recovery service or bring such systems to laboratories of our partners.
|
|
